agentd
Run agents behind the OpenAI client API, sandboxed.
- PTC: the model writes bash/python fences instead of JSON tool calls; MCP servers and
@toolfunctions show up as skills. - Harnesses: run Claude Code, Codex, OpenCode or omp through the same API and switch between them mid-conversation.
- Sandboxes: all agent code runs in a libkrun microVM or a Docker container, with no network and no credentials.
- Egress: optional network access through a host proxy that injects fnox secrets, so the sandbox never holds them.
- agentd serve: sessions, background turns and schedules as an API, reachable from other boxes over p2claw.
Install
uv add agentd
Then set up a sandbox:
# macOS (Apple Silicon)
brew tap slp/krun
brew trust --formula slp/krun/libkrun slp/krun/libkrunfw slp/krun/virglrenderer-krun
brew install slp/krun/libkrun
python -m agentd.sandbox.rootfs build agents # base image (needs Docker)
# Linux (KVM)
agentd-sandbox linux setup
# macOS via Colima (M3+, macOS 15+)
agentd-sandbox colima setup
# or Docker
python -m agentd.sandbox.rootfs build agents
Wheels for macOS arm64 and Linux x86_64/aarch64 include the launcher, agentd-net and (for Linux and Colima) libkrun, so nothing gets compiled. From a checkout, run agentd/sandbox/build.sh first.
agentd-sandbox status shows what's ready. Details, custom images and mounts: docs/sandboxes.md.
PTC
from agentd import patch_openai_with_ptc, display_events, tool
from openai import OpenAI
@tool
def calculate(expression: str) -> str:
"""Evaluate a math expression."""
return str(eval(expression, {"__builtins__": {}}))
client = patch_openai_with_ptc(OpenAI(), cwd="./workspace")
stream = client.responses.create(model="claude-sonnet-5", input="List files, then calculate 12*12", stream=True)
for event in display_events(stream):
if event.type == "text_delta":
print(event.text, end="")
elif event.type == "code_execution":
print(f"\n$ {event.code}\n{event.output}")
More: docs/ptc.md.
Harnesses
client = patch_openai_with_ptc(OpenAI(), cwd="./workspace", harness="claude-code")
r = client.responses.create(model="claude-sonnet-5", input="Add a test for utils.py and run it")
r = client.responses.create(input="Review that test", previous_response_id=r.id, harness="codex")
harness= is "ptc" (default), "claude-code", "codex", "opencode" or "omp". Each runs the real CLI inside the sandbox; credentials stay on the host behind a proxy. agentd.available(client) says which harnesses are ready and what models they have. Resume, transcripts, custom model servers: docs/harnesses.md.
Network and secrets
from agentd import KrunExecutor
from agentd.egress import Egress
from agentd.egress.approvals import Approvals
executor = KrunExecutor(egress=Egress(
allow=["pypi.org", "files.pythonhosted.org"],
approvals=Approvals(webhook="https://approver.example/hook"),
))
Sandboxes get placeholders; the proxy swaps in real values from fnox only for the hosts, methods and paths its rules allow. Anything else is refused or sent to your approval webhook. libkrun only. docs/egress-and-secrets.md.
agentd serve
agentd serve
Serves sessions over Unix sockets: turns, background runs, schedules, transcripts. Other boxes reach it over p2claw, and agentd.remote.Fleet drives them. docs/agentd-serve.md.
Plain tool calling
patch_openai_with_mcp(OpenAI()) runs MCP tool calls in a regular tool_calls loop with any LiteLLM provider, and uvx agentd config.yaml runs YAML-configured agents that react to MCP resource changes. docs/tool-calling.md.
Coming from 0.8: docs/upgrading-0.9.md.
License
MIT
1 maintainer
Metadata
1 maintainer
Release files for agentd 0.9.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| agentd-0.9.0.tar.gz | 4.9 MB | Details |
Built distributions (wheels)
| File | Reset | |||
|---|---|---|---|---|
| agentd-0.9.0-py3-none-manylinux_2_28_x86_64.whl | Python 3 | none | Linux glibc 2.28+ x86-64 | Details |
| agentd-0.9.0-py3-none-manylinux_2_28_aarch64.whl | Python 3 | none | Linux glibc 2.28+ ARM64 | Details |
| agentd-0.9.0-py3-none-macosx_14_0_arm64.whl | Python 3 | none | macOS 14.0+ ARM64 | Details |
| agentd-0.9.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 12.3 MB
Release files / agentd-0.9.0.tar.gz
| Download URL | agentd-0.9.0.tar.gz |
|---|---|
| Size | 4.9 MB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
e69896248860d89b07d8b58ada76b99308dfa8792a58109997383d98f25e9ef9
|
|
BLAKE2b-256 checksum How to use checksums |
238f0b222eb05ed92b541cb0d80d0d020d76fd3042c85358cbe3bc8633b60d99
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 2, 2026.
Transparency logRelease files / agentd-0.9.0-py3-none-manylinux_2_28_x86_64.whl
| Download URL | agentd-0.9.0-py3-none-manylinux_2_28_x86_64.whl |
|---|---|
| Size | 2.5 MB |
| Tags | Linux glibc 2.28+ x86-64 Python 3 |
|
SHA-256 checksum How to use checksums |
8ad5e1fde1083c202b1b19da34cdf74d72fa6f33a12e65e6851b3ca533f12932
|
|
BLAKE2b-256 checksum How to use checksums |
db02a531574a380735727224fdfaca792932e2e8c6b9e10e0f04881d860d87e6
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 2, 2026.
Transparency logRelease files / agentd-0.9.0-py3-none-manylinux_2_28_aarch64.whl
| Download URL | agentd-0.9.0-py3-none-manylinux_2_28_aarch64.whl |
|---|---|
| Size | 2.1 MB |
| Tags | Linux glibc 2.28+ ARM64 Python 3 |
|
SHA-256 checksum How to use checksums |
69ec159249a633417acbb215a3a3553156eef9c378b48cf59b398a0b6477dec4
|
|
BLAKE2b-256 checksum How to use checksums |
36ff5051afe4637b3e05d52607a619f17dcd4c6d5353d6561d52704db52428ff
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 2, 2026.
Transparency logRelease files / agentd-0.9.0-py3-none-macosx_14_0_arm64.whl
| Download URL | agentd-0.9.0-py3-none-macosx_14_0_arm64.whl |
|---|---|
| Size | 2.5 MB |
| Tags | Python 3 macOS 14.0+ ARM64 |
|
SHA-256 checksum How to use checksums |
17657894cf2433aaeef13ad480da113fac1a0a049da8be58f7b01b6470dd226b
|
|
BLAKE2b-256 checksum How to use checksums |
64977fc34defdd1e0a1c0285888788a31d72b196527dbcbe10630f8809a0aae6
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 2, 2026.
Transparency logRelease files / agentd-0.9.0-py3-none-any.whl
| Download URL | agentd-0.9.0-py3-none-any.whl |
|---|---|
| Size | 233.2 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
081c7633c79f89cedb4789a67018239a7d9739d32ef09f818d829ce5eb48b7fd
|
|
BLAKE2b-256 checksum How to use checksums |
5fbb14cde0169ab97abe9ff2c1609bd1e8331324fe7089568b0bc9042d719936
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 2, 2026.
Transparency log
